CVE Vulnerability Catalog

Metamail before 2.7-7.2 allows remote attackers to overwrite arbitrary files via an email message containing a uuencoded attachment that specifies the full pathname of the file to be modified, processed by uuencode in Metamail scripts such as sun-audio-file.

An unknown vulnerability in the IPv6 capability in IRIX 6.5.19 causes snoop to process packets as the root user, with unknown implications.

Multiple buffer overflows in xgalaga 2.0.34 and earlier allow local users to gain privileges via a long HOME environment variable.

Buffer overflow in the WWWLaunchNetscape function of Adobe Acrobat Reader 5.0.7 and earlier allows remote attackers to execute arbitrary code via a .pdf file with a long mailto link.

The Tutorials 2.0 module in XOOPS and E-XOOPS allows remote attackers to execute arbitrary code by uploading a PHP file without a MIME image type, then directly accessing the uploaded file.

TUTOS 1.1 allows remote attackers to execute arbitrary code by uploading the code using file_new.php, then directly accessing the uploaded code via a request to the repository containing the code.

Traceroute-nanog version 6.1.1 allows local users to overwrite unauthorized memory and potentially execute arbitrary code via certain 'nprobes' and 'max_ttl' arguments that cause an integer overflow.

CVE-2003-0478 describes a format string vulnerability in Bahamut IRCd 1.4.35 and earlier, as well as other IRC daemons based on Bahamut running in debug mode. This allows remote attackers to cause a denial of service and potentially execute arbitrary code via a request containing format strings.

Multiple buffer overflows in Kerio MailServer 5.6.3 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code.

SQL injection vulnerability in Cyberstrong eShop 4.2 and earlier allows remote attackers to steal authentication information and gain privileges via the ProductCode parameter in (1) 10expand.asp, (2) 10browse.asp, and (3) 20review.asp.

Snitz Forums 3.4.03 and earlier allows attackers to gain privileges as other users by stealing and replaying the encrypted password after obtaining a valid session ID.

There is an SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before version 1.2.9rc1 that allows remote attackers to execute arbitrary SQL queries.

Cistron RADIUS daemon (radiusd-cistron) version 1.6.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large value in an NAS-Port attribute, leading to a buffer overflow.

A stack-based buffer overflow in Active Directory in Windows 2000 before SP4 can be exploited by remote attackers. Attackers can cause a denial of service (reboot) and potentially execute arbitrary code by sending an LDAP version 3 search request with a large number of conditions.

Buffer overflow in the 'RuFSI Utility Class' ActiveX control used for the Symantec Security Check service allows remote attackers to execute arbitrary code via a long argument to CompareVersionStrings.

Buffer overflow in the HTML Converter (HTML32.cnv) on various Windows operating systems allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via cut-and-paste operation, as demonstrated in Internet Explorer 5.0 using a long 'align' argument in an HR tag.

The password.asp file in Snitz Forums version 3.4.03 and earlier allows remote attackers to reset passwords and gain privileges as other users by sending a modified request to password.asp with a different member id.

Caché Database 5.x installs the /cachesys/csp directory with insecure permissions, allowing local users to execute arbitrary code by adding server-side scripts that are executed with root privileges.

Buffer overflow in the ShellExecute API function of SHELL32.DLL in Windows 2000 before SP4 may allow attackers to cause a denial of service or execute arbitrary code via a long third argument.

CVE-2003-0510 describes a format string vulnerability in ezbounce versions 1.0 through 1.50 that allows remote attackers to execute arbitrary code via the 'sessions' command.